EseeCloud Devices Found to Contain Hard-Coded Credentials in Critical Flaw

The National Vulnerability Database recorded a critical security flaw in EseeCloud devices that allows attackers to log in using hard-coded credentials. According to the advisory, the issue is tracked as CVE-2026-107617 and carries a CVSS score of 9.8. This rating places the vulnerability in the critical severity range, indicating a high level of risk for users of the affected software.

The weakness is categorized under CWE-798, which relates to use of hard-coded credentials. The description states that an attacker can use these embedded credentials to log in to EseeCloud devices. This means the authentication mechanism relies on static information rather than unique, user-defined passwords for this specific access vector. The presence of such credentials creates a direct pathway for unauthorized access if the credentials are known or discoverable.

Context and Background

The vulnerability affects products manufactured by Guangzhou Juan IoT Technology Co., Ltd. The company produces EseeCloud devices, which are connected through the EseeCloud App and associated firmware. The issue is present in multiple components of the software stack, including both the mobile application interface and the device firmware itself. This suggests the hard-coded credentials are embedded at a foundational level within the software architecture.

According to the NVD record, the flaw is present in the EseeCloud App up to version 4.9.6. It also affects EseeCloud Firmware up to version 4.9.86.0. Any device running these versions or earlier is potentially exposed to this authentication bypass method. The specific nature of CWE-798 implies that the credentials are fixed within the code, rather than being dynamically generated or stored securely in a separate database.

Who Is Affected

Security and technology professionals managing EseeCloud deployments should review their current software versions immediately. The primary vendors affected are those distributing or utilizing Guangzhou Juan IoT Technology Co., Ltd. products. This includes organizations that have integrated EseeCloud devices into their broader Internet of Things infrastructure. The scope of the issue covers both the client-side application and the server-side firmware running on the devices.

Users running EseeCloud App version 4.9.6 or any prior release are considered affected by this vulnerability. Similarly, devices operating on EseeCloud Firmware version 4.9.86.0 or earlier are also impacted. The critical CVSS score of 9.8 highlights the severity of the potential impact. Administrators should identify all instances of these specific versions within their network to assess the extent of the exposure.

What should you do?

No patch or fix has been confirmed yet for CVE-2026-107617. Security teams should monitor for official updates from Guangzhou Juan IoT Technology Co., Ltd. In the meantime, limiting network access to EseeCloud devices can reduce the risk of exploitation. Isolating affected devices from critical network segments is a recommended temporary measure. Users should also verify if their current versions are within the affected range.